Trust.ID Talk

The episode covers meaningful ground on code signing infrastructure, baseline requirements, and post-quantum cryptography preparedness, but suffers from significant filler and repetition. The core insights - centralized key management, lack of visibility, and crypto agility - are valuable but compressed into an 11-minute format with padding (the opening hook, the closing tech gadget question) that dilutes density.

“Code signing is a process much more than any isolated key management or certificate management issue”

“If you don't know where your keys are, if you don't know what certificates have been issued in your organization's name, well, then you're basically figured out for you”

The guest reframes code signing as a systemic organizational process rather than isolated technical control, which is somewhat fresh. However, the broader themes - centralization, visibility, compliance frameworks, post-quantum preparation - are increasingly standard in security discourse. The framing lacks truly contrarian or first-principles thinking.

“Code signing is a process much more than any isolated key management or certificate management issue”

“Crypto agility is the key here”

Stefan Wenig as CEO/CTO of SignPath brings direct operational experience in code signing infrastructure and shows deep familiarity with PKI standards, CAB forum requirements, and post-quantum roadmaps. However, as the founder of a vendor in this space, there is an inherent incentive to emphasize centralization and platform adoption. His seniority is clear but the guest has a commercial interest in the solutions discussed.

“Stefan Wenig, CEO and CTO at SignPath”

“I think a lot of code signing happens in the Windows ecosystem where most organizations were already using standard validation certificates”

The episode references concrete industry developments (CAB forum changes, FIPS requirements, one-year certificate validity reduction, NIST algorithms, MLDSA) but provides minimal quantified impact, no customer examples, no specific incident analysis, and no data on the scale of the problem despite the title invoking 'billion dollar' losses. Specificity remains largely at the regulatory and technical level without operational metrics.

“Code signing certificates by CAs cannot be issued for up to three years any longer. But just a single year”

“GSM vendors are implementing the NIST certified uh, algorithms. The first vendors are already there”

The host asks reasonable setup questions and nods to frameworks mentioned (the puzzle analogy, crypto agility), but rarely pushes back, challenge claims, or drill into contradictions. The questions are open-ended without sharp follow-ups on the billion-dollar claim, the gap between knowledge and action, or how organizations actually fail. The closing tech gadget question wastes the remaining time and shows lack of interview discipline.

“I love the analogy of the picture and the puzzle and how code signing is part of uh, that puzzle”

“What is the one piece of tech you could not live without?”